Cybersecurity GRC Manager, FCH - IT - SE

JOB REQUIREMENTS: Discover. Achieve. Succeed. #BeHere Location: US:WI:MENOMONEE FALLS at our WOODLAND PRIME 400 facility. This job is REMOTE. FTE: 1.000000 Standard Hours: 40.00 Shift: Flexible 1st shift between 7 am and 5 pm Shift Details: Holidays: Weekends: Job Summary: Healthcare security isn't a compliance checkbox problem - it's a patient safety problem. At Froedtert ThedaCare, the Cybersecurity GRC Manager owns the program that connects our governance posture to real-world risk outcomes for patients, clinicians, and the communities we serve across Wisconsin. This is a high-visibility, high-autonomy leadership role inside a Cybersecurity & Infrastructure team that operates with strategic intent and operational rigor. You will build and run a team of 5+ GRC professionals, serve as the internal subject matter authority on compliance and risk, and translate complex regulatory requirements into actionable programs that the broader organization can execute against. If you've built GRC programs from scratch (or rebuilt ones that needed it), know your way around a HIPAA gap analysis and a third-party risk assessment in equal measure, are people-focused, and lead with clarity rather than bureaucracy - this is the role for you. People Leadership Lead, mentor, and grow a team of 5+ GRC analysts and specialists across compliance, risk, policy, and awareness domains Establish clear role expectations, development pathways, and performance standards for each team member Foster a team culture that balances rigor with pragmatism - we care about outcomes, not just documentation HIPAA & Healthcare Compliance Serve as the organization's functional lead for HIPAA Privacy and Security Rule compliance, including ongoing gap assessment and remediation tracking Coordinate with Legal, Privacy, and Clinical Operations to ensure compliance obligations are understood and operationalized across the enterprise Oversee preparation for and response to regulatory inquiries, OCR investigations, and audit activity Risk Management & Third-Party Risk Own the enterprise cybersecurity risk register, ensuring risks are identified, assessed, prioritized, and tracked to resolution Lead the third-party risk management program, including vendor onboarding assessments, ongoing monitoring, and risk-tiering across the supply chain Develop risk reporting for executive and board audiences, translating technical risk into business impact language Policy & Controls Frameworks Own the cybersecurity policy lifecycle: authorship, review cadence, version control, approval workflows, and exception management Maintain alignment to NIST CSF, managing control mapping, evidence collection, and control effectiveness measurement Drive continuous improvement of the controls environment based on assessment findings, threat intelligence inputs, and regulatory changes Audit & Assessment Management Serve as the primary point of contact and program lead for internal and external cybersecurity audits and assessments Coordinate evidence collection, manage stakeholder readiness, and oversee finding remediation tracking through to closure Develop and maintain audit-ready documentation across all GRC domains. Security Awareness & Phishing Simulation Own the enterprise security awareness program, including curriculum development, delivery scheduling, and effectiveness measurement Manage the phishing simulation program end-to-end: scenario design, cadence, metrics, and targeted follow-up training for at-risk populations Tailor awareness content for diverse audiences - from clinical staff to executive leadership - with a voice that educates rather than shames EXPERIENCE DESCRIPTION: To view the full job description please use the link below. https://www.aplitrak.com/?adid=YmJnZW5lcmljLjgyMzA1Ljg3NzBAZnJvZWR0ZXJ0Y29tcC5hcGxpdHJhay5jb20 ***** APPLICATION INSTRUCTIONS: Apply Online: https://www.aplitrak.com/?adid=YmJnZW5lcmljLjgyMzA1 jg3NzBAZnJvZWR0ZXJ0Y29tcC5hcGxpdHJhay5jb20